News for hackers. Stuff that matters.
Re:Personal info of 93M Mexicans exposed on AWS by jordigh on Sunday April 24, 2016 @06:09PM (#11561592)
They've identified who leaked the database to AWS:

http://www.diariodemexico.com.mx/inemexico-encuentra-quien-f...

The government isn't publishing details, but the article gives the impression that it was some Mexican political party acting out of line who should not have uploaded this data to US servers. It appears that each party receives a copy of electoral registrations.

¿Qué chingados? I didn't know every party got a copy of all voter registrations. This seems grossly undemocratic.

Re:Personal info of 93M Mexicans exposed on AWS by Spooky23 on Sunday April 24, 2016 @06:16PM (#11561615)
In the US, voter registration is completely open. You can walk down to your Board of Elections and look at the full register, including party registration and whether you voted or not.

For contested elections, party inspectors will note active voters who haven't voted yet and report, which generates phone calls or even volunteers dropping by to drive voters to the polls.

IMO, transparency is required for democracy.

Re:Personal info of 93M Mexicans exposed on AWS by lazaroclapp on Sunday April 24, 2016 @08:18PM (#11561934)
Yeah, but the database contains occupation, address and potentially can be correlated with phone numbers. In a country where phone extortion and kidnappings are things that happen with surprising regularity.

Keep in mind also that your voting ID card in Mexico is your primary identification, similar to driver licenses in the U.S. The data from this breach can allow someone to create a pretty good fake of any voting card, which may be used to impersonate people for: banking operations, government processes (that don´t require the CURP, our equivalent of a SSN) and yes, also during elections. Voter fraud might not be much of a problem in the U.S. in reality, but in Mexico it definitely is.

Re:Personal info of 93M Mexicans exposed on AWS by DannyBee on Sunday April 24, 2016 @11:52PM (#11562449)
"Yeah, but the database contains occupation, address and potentially can be correlated with phone numbers. "

Err, the US database contains address as well.

I remember when i used to run politics and elections products, we were basically the only company in the US to explicitly request they not give us names or anything we did not need (we were building street segment to voting location mapping)

Re:Personal info of 93M Mexicans exposed on AWS by lazaroclapp on Monday April 25, 2016 @02:20PM (#11566167)
Yeah, but how often have you been called in the U.S., heard someone sobbing on the other end, then told by someone else that they have your family member and that they will hurt them if you don't send them money immediately? (99% of the time they have nobody and it is a phishing call, but with this information then suddenly it becomes an easier to convince people, among other things). I have answered that call. My mom has answered that call (and contacted me over another phone to make sure it was indeed a scam).

My point is that what works on the U.S. and what is considered sensitive information in the U.S. might not match what is sensitive in other societies. My mailing address and phone number are relatively public while in the U.S., but back in Mexico I would never do it that way.

Re:Personal info of 93M Mexicans exposed on AWS by laen on Sunday April 24, 2016 @09:51PM (#11562199)
Exactly. I'm failing to see why this story is generating so much interest.

Here's one of the 50 websites where you can see every American citizen registered to vote... includes their DOB, Address, Voter ID etc...

http://www.oklavoters.com/

and while you're there check out the removal request policy page - it's quite humorous.

EDIT: If you are wondering how the website obtained data specifically for Oklahoma please see https://www.ok.gov/elections/Candidate_Info/Voter_List/index...

Re:Personal info of 93M Mexicans exposed on AWS by rvolkan on Sunday April 24, 2016 @10:10PM (#11562246)
For some countries, voter info is as effective as SSN of US. I guess, Mexico is one of them.
Re:Personal info of 93M Mexicans exposed on AWS by atdt on Monday April 25, 2016 @01:59AM (#11562685)
Doesn't the fact that they have a removal request policy page at all suggest that at least some Americans find it surprising that voter data is freely available online?
Re:Personal info of 93M Mexicans exposed on AWS by yxlx on Monday April 25, 2016 @05:19AM (#11563214)
>check out the removal request policy page - it's quite humorous.

I found it childish and unprofessional, just like the reply letters TPB wrote in response to DMCA requests.

Re:Personal info of 93M Mexicans exposed on AWS by Hondor on Monday April 25, 2016 @06:44AM (#11563434)
In both cases, don't forget who it's addressed to - people who have made rude, unreasonable demands and threats. Those people are bullies so it's fair to insult them.
Re:Personal info of 93M Mexicans exposed on AWS by facetube on Monday April 25, 2016 @09:00AM (#11563889)
Those people are bullies so it's fair to insult them.

Ladies and gentlemen, this is why we can't have nice things (as a species).

Re:Personal info of 93M Mexicans exposed on AWS by prof_hobart on Monday April 25, 2016 @12:09PM (#11565175)
As a non-American, the bit that amazes me is "political affiliation .. and voting history". Really?

Isn't voting meant to be a private thing?

Re:Personal info of 93M Mexicans exposed on AWS by lg on Monday April 25, 2016 @12:28PM (#11565350)
that's when you voted, not who you voted for.
Re:Personal info of 93M Mexicans exposed on AWS by prof_hobart on Monday April 25, 2016 @04:49PM (#11567248)
Political affiliation isn't.
Re:Personal info of 93M Mexicans exposed on AWS by rdudek on Sunday April 24, 2016 @11:29PM (#11562406)
Interesting, list does not seem complete as I'm effectively missing from that list.
Re:Personal info of 93M Mexicans exposed on AWS by nightpool on Monday April 25, 2016 @12:00AM (#11562465)
the linked website is for Oklahoma only.
Re:Personal info of 93M Mexicans exposed on AWS by jordigh on Sunday April 24, 2016 @06:25PM (#11561648)
Address and occupation and whether you have any twins is open too, for the whole country? Can you look this up right now for any adult estadounidense?

In Mexico, this isn't transparency, as only the political parties get a copy. This is surveillance, probably used for more effective targetted campaigning, which has historically been used for buying votes.

I'm not sure I will ever renew my Mexican voter registration.

Re:Personal info of 93M Mexicans exposed on AWS by mariorz on Sunday April 24, 2016 @06:57PM (#11561743)
The database is given to parties so they can audit if people live where they are voting, or even if they live for that matter. Not giving them access is not an option, if you want the continue having a voting system that does not require trust, as the mexican voting system was designed to allow.

I agree that the database should be made public for all citizens, as it currently stands, only parties registered for elections get a copy, and no doubt use it for their campaigns. This puts people outside of the party system in a disadvantage against the parties, particularly relevant for things like citizen initiatives.

Re:Personal info of 93M Mexicans exposed on AWS by WildUtah on Monday April 25, 2016 @12:09AM (#11562484)
"I'm not sure I will ever renew my Mexican voter registration."

What are you going to use for ID if you don't have a credencial?

Re:Personal info of 93M Mexicans exposed on AWS by jordigh on Monday April 25, 2016 @07:02AM (#11563479)
Passport.
Re:Personal info of 93M Mexicans exposed on AWS by reymus on Monday April 25, 2016 @09:47AM (#11564124)
Do you live in Mexico? I understand if you don't, but if you do... wow! it's such a pain to carry a passport. My IFE is expired right now and I have been carrying the passport for a couple of weeks, always afraid I will lose it. The cost of the passport alone would be enough motivation for leaving it at home.

To be fair, driver license is also good enough for most cases.

Re:Personal info of 93M Mexicans exposed on AWS by Spooky23 on Sunday April 24, 2016 @06:55PM (#11561737)
I'm not saying it isn't a problem. IIRC, there was a breach in Georgia with a lot of extra information similar to what you describe.

If it isn't provided by the state, Political parties buy lots of information based on the voter rolls. They know alot.

Re:Personal info of 93M Mexicans exposed on AWS by jlg23 on Sunday April 24, 2016 @08:46PM (#11561991)
Nobody cares whether it could be worse, the point is that it must be better[1].

The data leaked is enough to gain access to almost a hundred million people's account on any web-service or, as some other comment pointed out, in Mexico's case even to real-life services like banking.

[1] The United States are not the norm. You might live there, but that makes you a minority of the world population. There are some nations that actually value democracy and privacy, not just on paper.

Re:Personal info of 93M Mexicans exposed on AWS by eru on Sunday April 24, 2016 @08:07PM (#11561909)
Registering with a party in the US always struck me as crazy. Can't they at least uphold the fiction that people vote on the merit of issues?
Re:Personal info of 93M Mexicans exposed on AWS by akira2501 on Sunday April 24, 2016 @08:33PM (#11561962)
> Can't they at least uphold the fiction that people vote on the merit of issues?

It's not a direct democracy.. other than state referendums, people generally do not have an opportunity to _actually_ vote on issues.

Re:Personal info of 93M Mexicans exposed on AWS by boulos on Sunday April 24, 2016 @08:53PM (#11562011)
In many (most?) primaries it's a requirement that you be a registered member of that party. Luckily for me, California doesn't subscribe to this policy.
Re:Personal info of 93M Mexicans exposed on AWS by aiiane on Sunday April 24, 2016 @09:04PM (#11562047)
Except for the Republican presidential primary.
Re:Personal info of 93M Mexicans exposed on AWS by boulos on Monday April 25, 2016 @02:04AM (#11562695)
No. For example:

https://www.washingtonpost.com/news/volokh-conspiracy/wp/201...

(The url is the whole story).

Re:Personal info of 93M Mexicans exposed on AWS by WildUtah on Monday April 25, 2016 @12:10AM (#11562485)
Many states don't have party registration. It's a convenience for parties that want to close primaries and target voters for GOTV.
Re:Personal info of 93M Mexicans exposed on AWS by superuser2 on Sunday April 24, 2016 @11:02PM (#11562357)
Choosing a party is pretty much how you express a position on the issues.
Re:Personal info of 93M Mexicans exposed on AWS by eru on Monday April 25, 2016 @02:20AM (#11562744)
In most parts of the world, only a few people are officially registered with any party. Normally, you just show up and vote what you feel like.
Re:Personal info of 93M Mexicans exposed on AWS by Redoubts on Monday April 25, 2016 @12:18AM (#11562501)
Do unaffiliated people have a say who gets on a party list in Europe?
Re:Personal info of 93M Mexicans exposed on AWS by rjsw on Monday April 25, 2016 @05:20AM (#11563220)
France had an open primary for the Socialist Party presidential candidate in 2011.
Re:Personal info of 93M Mexicans exposed on AWS by eru on Monday April 25, 2016 @02:21AM (#11562746)
Only via public opinion.
Re:Personal info of 93M Mexicans exposed on AWS by draugadrotten on Monday April 25, 2016 @04:25AM (#11563067)
> ...party inspectors will note active voters who haven't voted yet and report, which generates phone calls or even volunteers dropping by to drive voters to the polls.

Isn't this a great example why it's bad that this data is open.

In Mexico, perhaps volunteers are dropping by to drive voters to/from the polls. With guns.

Re:Personal info of 93M Mexicans exposed on AWS by lukeschlather on Monday April 25, 2016 @04:48AM (#11563117)
That's way too messy when you can just threaten the poll workers with guns and stuff the ballot boxes. Or better yet, just be the poll workers yourself and skip the guns entirely.
Re:Personal info of 93M Mexicans exposed on AWS by warrenm on Monday April 25, 2016 @03:27PM (#11566662)
Why? You registered with a party and the local board of elections - the party will know if you've voted, as does the BoE.

Ditch the party system, and maybe it gets better - I think it would.

Re:Personal info of 93M Mexicans exposed on AWS by ASalazarMX on Sunday April 24, 2016 @09:16PM (#11562088)
Re:Personal info of 93M Mexicans exposed on AWS by krzrak on Monday April 25, 2016 @07:22AM (#11563541)
> In the US, voter registration is completely open. You can walk down to your Board of Elections and look at the full register, including party registration and whether you voted or not.

I don't get what purpose does it serve?

Re:Personal info of 93M Mexicans exposed on AWS by booop on Monday April 25, 2016 @04:44AM (#11563113)
Another possibility in contested elections is party members tracking down opposing voters with a comprehensive list of who to threaten/kill and where to find them.
Re:Personal info of 93M Mexicans exposed on AWS by armandososa on Sunday April 24, 2016 @06:31PM (#11561671)
That link's info is so stupid. They say they know who did it, but they won't say because they don't want to alert the guilty party before the investigation is over. Guess what? the people who did it know they did it!

Also, the note says that the info is on "Amazon's sales portal" WTF?

Re:Personal info of 93M Mexicans exposed on AWS by jordigh on Sunday April 24, 2016 @06:43PM (#11561707)
Yeah, looks like reporters can't figure out that "Amazon" means more than a website to buy things from.
Re:Personal info of 93M Mexicans exposed on AWS by rdtsc on Sunday April 24, 2016 @08:48PM (#11561998)
> Guess what? the people who did it know they did it!

But they don't know the authorities know who did it.

Re:Personal info of 93M Mexicans exposed on AWS by armandososa on Monday April 25, 2016 @01:52AM (#11562670)
If you, as a kid, broke a window in your school, and the principal is, like, "Look, we've seen the surveillance video and we know who did it, but we ain't saying anything until next friday", you'll know for sure you have until friday to lawyer up or skip town or whatever kids do.
Re:Personal info of 93M Mexicans exposed on AWS by patrickaljord on Monday April 25, 2016 @09:30AM (#11564016)
Actually, when schools say so it usually means they're bluffing, the cameras were broken, they have no clue who did it and they're counting on fear to make people confess.
Re:Personal info of 93M Mexicans exposed on AWS by yoo1I on Sunday April 24, 2016 @08:55PM (#11562019)
Unless they of course they read the news, which is something that seems likely.

... which, of course, was the original point.

Re:Personal info of 93M Mexicans exposed on AWS by rdtsc on Sunday April 24, 2016 @09:04PM (#11562049)
> ... which, of course, was the original point.

Right, which explains they they were reluctant to put it in the news i.e. "... but they won't say because they don't want to alert the guilty party before the investigation is over."

So it doesn't seem completely illogical why they'd do it as gp post suggests.

Re:Personal info of 93M Mexicans exposed on AWS by basicplus2 on Sunday April 24, 2016 @11:57PM (#11562461)
could be normal political process.. "hey Fred we won't tell anyone it was you if you support my outrageous bill which enriches my personal fortune some more.."
Re:Personal info of 93M Mexicans exposed on AWS by narag on Sunday April 24, 2016 @06:31PM (#11561667)
I believe it's true for Spain also, so parties can spam us with voting propaganda. The information was also sold to commercial spammers too. It was detected because small errors in spelling, not present in other records, were reproduced.
Re:Personal info of 93M Mexicans exposed on AWS by superuser2 on Sunday April 24, 2016 @07:06PM (#11561771)
Why does it matter whether it was uploaded to US servers? A wide open MongoDB is a wide open MongoDB no matter where it's physically located.
Re:Personal info of 93M Mexicans exposed on AWS by arcticfox on Sunday April 24, 2016 @06:14PM (#11561612)
If the government is relying on outside political parties to keep the data secure, it might as well be public anyways.
Re:Personal info of 93M Mexicans exposed on AWS by venomsnake on Monday April 25, 2016 @03:00AM (#11562840)
I think that it is grossly democratic. Everyone is on the same playing field.

And anyway the whole registering to vote thing is undemocratic. You have valid citizen id - you show and vote, and that is it. In Europe where everyone has government issued id card the system works fine.

Re:Personal info of 93M Mexicans exposed on AWS by wang_li on Monday April 25, 2016 @01:13PM (#11565675)
In the US the suggestion that voting require an ID card is met with all the reasons people can't be bothered to get an ID card. Things like it's too far to go to get the card. Or it costs too much. Or they can't prove they are citizens.

If states were at all serious about voter verification through ID, they'd make every non-constitutionally guaranteed service require a photo ID. Then when it gets back to SCOTUS they could readily report that every resident in their state already has a photo ID.

Re:Personal info of 93M Mexicans exposed on AWS by nso on Monday April 25, 2016 @12:16AM (#11562498)
Funny thing is that you already could buy this database for a few hundred dollars at the black markets in Mexico City. You can also walk into stores there that openly sell any drug you could possibly want... like it's on display on shelfs... or guns... or whatever else you want.
Re:Personal info of 93M Mexicans exposed on AWS by ludamad on Monday April 25, 2016 @01:28AM (#11562615)
This exact data though?
Re:Personal info of 93M Mexicans exposed on AWS by Aelinsaar on Sunday April 24, 2016 @06:10PM (#11561595)
It seems like a disaster waiting to happ- oh wait, right.